On BashCore I noticed masscan picks the default ip link device (e.g. wlo1) and sends packets with your real IP, bypassing NordVPN.
If you run masscan, check with Wireshark (capture wlo1 vs nordlynx) and force --interface nordlynx to keep scans inside the VPN.
Stay safe.
#BashCore #infosec #Masscan #Wireshark #NordLynx #IP #VPN #NordVPN